The EU General Data Protection Regulation (GDPR) came into force in May of 2018. One of the reasons that the EU introduced the law is to give people more control over their personal data.
To prepare for the GDPR, companies have had to think carefully about their data protection and privacy practices.
One of the most important requirements for companies that fall under the scope of the GDPR is that they provide transparent and accessible information about the personal data they're processing. The way to do this is by having a clear and comprehensive Privacy Policy.
The GDPR covers the "processing" of "personal data." Article 4 (1) of the GDPR defines personal data as information that can be used "directly or indirectly" to identify a person. This is a very broad definition. Aside from the obvious things like a person's name, it can also include a person's:
Email address
Cookie data
IP address (even where it's a dynamic IP address)
"Processing" is a broad term. The GDPR covers any sort of automated data processing activity or filing (electronic or otherwise). This might include:
Asking your customers to fill out a contact form on your website
Storing a list of phone numbers
Sending direct marketing emails
According to Article 3 of the GDPR, the regulation applies to any person or organization that:
Offers goods and services in the EU (whether they're charged for, or provided for free);
Monitors the behavior of people in the EU.
So, your company might not be "offering goods and services" in the EU. But you will still fall under the GDPR if you:
Target EU residents with advertising cookies, or
Store your EU users' IP addresses in your log files
The GDPR covers all processing of the personal data of people in the EU - whether the actual act of processing is performed in the EU or not. Not only EU companies have to comply. Companies based anywhere else in the world - for example the United States, Canada, Russia - must comply, too.
While some laws, like the upcoming California Consumer Privacy Act, only apply to certain types of companies, the GDPR could apply to anyone that falls within its scope - including individuals, charities, public bodies and businesses.
Note that there are some exemptions, but most businesses will have to comply.
Cookie consent is one of the cornerstones of the EU’s General Data Protection Regulation. It’s the way websites ensure a legal processing of personal data from their users.
If the GDPR applies to you, you'll want to know how you can avoid infringing it.
EU data protection authorities can impose fines and other penalties on companies that breach the GDPR. It's not entirely clear how this will be enforced against non-EU businesses. But even the threat of a sanction will create a huge headache for your company.
The good news is that compliance is not all that difficult.
To comply with the GDPR:
Create a GDPR-compliant Privacy Policy,
Abide by the principles of the GDPR, and
Only process your users' personal data in a lawful way
Having a Privacy Policy is one of the ways that you can comply with a key principle of the GDPR - transparency.
Our Free Privacy Policy Generator helps you create a custom Privacy Policy for your website and mobile app. Just follow these few simple steps and your Privacy Policy will be ready to display in minutes.
Click on the "Free Privacy Policy Generator" button, located at the top of the website.
Select where your Privacy Policy will be used:
Answer a few questions about your business:
Enter the country and click on the "Next Step" button
d:
Almost done. Now enter your email address where you'd like your new Privacy Policy sent and click on the "Generate" button and you're don
e.
That's it. Now you can copy and paste your Privacy Policy code into your website, or link to your hosted Privacy Policy.
Your Privacy Policy must be:
Written in clear and simple language that your users can easily understand,
Comprehensive, so that it covers all aspects of your personal data processing activities, and
Easily accessible, particularly at the point that you're collecting your users' personal data or soon after if you've received it from elsewhere.
You likely already have a Privacy Policy. It's required under other privacy laws such as:
The California Online Privacy Protection Act (CalOPPA);
Canada's Personal Information Protection and Electronic Documents Act (PIPEDA);
The EU's Data Protection Directive (the GDPR's predecessor).
However, you likely need to update your Privacy Policy to ensure that you're compliant with the GDPR as well.
Here's what your GDPR-compliant Privacy Policy should contain.
Article 13 (1)(a) of the GDPR requires that you provide your users with:
"the identity and the contact details of the controller and, where applicable, of the controller's representative"
"The controller" refers to a "data controller" - someone who decides how and why personal data is processed.
Here's how cereal company Kellogg provides this information:
The first step is to get equipped with the GDPR training which will help you reach compliance. Our training courses are delivered by experienced trainers who will help you understand the benefits and how it can be applicable to your organization.
With the adequate combination of focus and dedication, you can become certified and distinguish yourself in the competitive market.